#!/bin/sh

# Nous vidons les chaînes :
/sbin/iptables -F
# Nous supprimons d'éventuelles chaînes personnelles :
/sbin/iptables -X 

# Nous les faisons pointer par défaut sur DROP

/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP

# Nous faisons de même avec toutes les autres tables,
# Ã|  savoir "nat" et "mangle", mais en les faisant pointer
# par défaut sur ACCEPT. Ca ne pose pas de problèmes
# puisque tout est bloqué au niveau "filter"

/sbin/iptables -t nat -F
/sbin/iptables -t nat -X
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
#/sbin/iptables -t nat -P INPUT ACCEPT
/sbin/iptables -t mangle -F
/sbin/iptables -t mangle -X
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P INPUT ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P FORWARD ACCEPT
/sbin/iptables -t mangle -P POSTROUTING ACCEPT

# Translation d'adresses pour tout ce qui traverse la passerelle
# en sortant par ppp0
/sbin/iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
/sbin/iptables -t nat -A POSTROUTING -s 10.82.1.23 -o ppp0 -j MASQUERADE
/sbin/iptables -t nat -A POSTROUTING -s 10.82.1.21 -o ppp0 -j MASQUERADE
/sbin/iptables -t nat -A POSTROUTING -s 10.82.1.22 -o ppp0 -j MASQUERADE

# Toutes les connexions qui sortent du LAN vers le Net
# sont acceptées
/sbin/iptables -A FORWARD -i eth0 -o ppp0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# Nous autions aussi bien pu écrire :
#/sbin/iptables -A FORWARD -i eth0 -o ppp0 -m state --state ! INVALID -j ACCEPT

# Seules les connexions déjÃ|  établies ou en relation avec
# des connexions établies sont acceptées venant du Net vers le LAN
/sbin/iptables -A FORWARD -i ppp0 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT


/sbin/iptables -t filter -A OUTPUT -o lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT
/sbin/iptables -t filter -A INPUT  -i lo -s 127.0.0.0/8 -d 127.0.0.0/8 -j ACCEPT

/sbin/iptables -t filter -A OUTPUT -o eth0 -s 10.82.1.0/24 -d 10.82.1.0/24 -j ACCEPT
/sbin/iptables -t filter -A INPUT  -i eth0 -s 10.82.1.0/24 -d 10.82.1.0/24 -j ACCEPT

/sbin/iptables -t filter -A OUTPUT  -s 127.0.0.1/8 -d 10.82.1.0/24 -j ACCEPT
/sbin/iptables -t filter -A INPUT   -d 127.0.0.1/8 -s 10.82.1.0/24 -j ACCEPT
/sbin/iptables -t filter -A OUTPUT  -s 10.82.1.0/24 -d 127.0.0.1/8 -j ACCEPT
/sbin/iptables -t filter -A INPUT   -d 10.82.1.0/24 -s 127.0.0.1/8 -j ACCEPT

#serveur dns
/sbin/iptables -A INPUT -i ppp0 --protocol udp --source-port 53 -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol udp --destination-port 53 -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 53 -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 53 -j ACCEPT

#serveur ssl
/sbin/iptables -A INPUT -i ppp0 --protocol udp --source-port 443 -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol udp --destination-port 443 -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 443 -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 443 -j ACCEPT


#seurveur web
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 80 -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 80 -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --destination-port 80 -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --source-port 80 -j ACCEPT

#serveur pop smtp
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 25 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 25 -m state --state NEW,ESTABLISHED -j ACCEPT

/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 110 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 110 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 995 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 995 -m state --state NEW,ESTABLISHED -j ACCEPT
#serveur ftp
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 21 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 21 -m state --state NEW,ESTABLISHED -j ACCEPT

#serveur antivirus
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 1027 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 1027 -m state --state NEW,ESTABLISHED -j ACCEPT

#Test firewall
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 443 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 443 -m state --state NEW,ESTABLISHED -j ACCEPT

#accepte les ping de wanadoo pour test connection 
/sbin/iptables -A OUTPUT -o ppp0 -d 193.252.122.103  --protocol icmp -j ACCEPT
/sbin/iptables -A INPUT -i ppp0  -s 193.252.122.103 --protocol icmp -j ACCEPT



#port realplyer
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 1090 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 1090 -m state --state NEW,ESTABLISHED -j ACCEPT

/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 554 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 554 -m state --state NEW,ESTABLISHED -j ACCEPT

#serveur de news
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 119 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 119 -m state --state NEW,ESTABLISHED -j ACCEPT

#xchat
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 6667 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 6667 -m state --state NEW,ESTABLISHED -j ACCEPT

#gnomemeeting
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 1720 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 1720 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 389 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 389 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 30000:60000 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 30000:60000 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 --protocol udp --source-port 5000:5016 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol udp --destination-port 5000:5016 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 --protocol udp --source-port 5020:5023 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol udp --destination-port 5020:5023 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 1731 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 1731 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 1503 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 1503 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 522 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 522 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 389 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 389 -m state --state NEW,ESTABLISHED -j ACCEPT

#serveurs de clef 
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 11371 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 11371 -m state --state NEW,ESTABLISHED -j ACCEPT

#ntpdate
/sbin/iptables -A OUTPUT -o ppp0 -m state --state NEW,ESTABLISHED -p udp --dport 123 -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 -m state --state ESTABLISHED -p udp --sport 123 -j ACCEPT

#serveur camstream
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 20 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 20 -m state --state NEW,ESTABLISHED -j ACCEPT

#serveur amule
/sbin/iptables -A INPUT -p tcp --dport 54320 -j ACCEPT
/sbin/iptables -A INPUT -p udp --dport 54323 -j ACCEPT
/sbin/iptables -A INPUT -p udp --dport 54321 -j ACCEPT
/sbin/iptables -A INPUT -p udp --dport 4242 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 4242 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 4242 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 4662 -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 54320:54323 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 54320:54323 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 --protocol udp --source-port 54320:54323 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol udp --destination-port 54320:54323 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 4242:4672 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 4242:4672 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 --protocol udp --source-port 4242:4672 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol udp --destination-port 4242:4672 -m state --state NEW,ESTABLISHED -j ACCEPT

#flux ogg
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 1441 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 1441 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 --protocol udp --source-port 1441 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol udp --destination-port 1441 -m state --state NEW,ESTABLISHED -j ACCEPT

#port9100
/sbin/iptables -A INPUT -i ppp0 --protocol udp --source-port 9100 -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol udp --destination-port 9100 -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 9100 -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 9100 -j ACCEPT

#port6667
/sbin/iptables -A INPUT -i ppp0 --protocol udp --source-port 6667 -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol udp --destination-port 6667 -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 6667 -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 6667 -j ACCEPT

#port1755
/sbin/iptables -A INPUT -i ppp0 --protocol udp --source-port 1755 -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol udp --destination-port 1755 -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 1755 -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 1755 -j ACCEPT

#pop3s
/sbin/iptables -A INPUT -i ppp0 --protocol udp --source-port 995  -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol udp --destination-port 995 -j ACCEPT
/sbin/iptables -A INPUT -i ppp0 --protocol tcp --source-port 995 -j ACCEPT
/sbin/iptables -A OUTPUT -o ppp0 --protocol tcp --destination-port 995 -j ACCEPT

#serveur APACHE


# FIN des règles de PORT FORWARDING